Installing VSatellites on RHEL, Oracle, and Rocky Linux
Table of Contents
Expand all | Collapse all
-
- Activate Next-Generation Trust Security
-
-
- Configure Akamai Connection
- Configure AWS Connection
- Configure Azure Key Vault Connection
-
- Workload Identity Federation Authentication
- Workload Identity Federation - Azure Identity Provider Authentication
- Next-Gen Trust Security Generated Key Authentication
- User Permissions
- Workload Identity Federation Authentication
- Next-Gen Trust Security Generated Key Authentication
- User Permissions
- Supported OIDC Claims
-
-
-
- Working with the Built-in CA
- Add AWS Public CA
- Add AWS Private CA
- Add DigiCert One Certificate Authority
- Add Entrust
- Add GlobalSign Atlas
- Add GlobalSign MSSL
- Add GoDaddy
- Add Google Cloud Private CA
- Add a HID PKIaaS CA
- Add Certificate Manager - Self-Hosted
- Set Up an OpenSSL Certificate Authority Connector
- Create a Sectigo Certificate Manager Certificate Authority
- Add Zero Touch PKI
- Set Up Certificate Expiration Notifications
- Using a Custom DNS Provider
-
-
-
-
- Create an F5 BIG-IP LTM Machine
- Create a Microsoft Azure Private Key Vault Machine
- Create a Microsoft Azure Application Registration Machine
- Create a Microsoft IIS Machine
- Create a Microsoft Windows (PowerShell) Machine
- Create a Microsoft SQL Server Machine
- Create a Common KeyStore Machine
- Create a Citrix ADC Machine
- Create an Imperva WAF Machine
- Create a VMware NSX Advanced Load Balancer (AVI) Machine
- Create an A10 Thunder ADC Machine
- Create a Cloudflare Machine
- Create Kemp Virtual LoadMaster Machine
- Create a Palo Alto Panorama Machine
- Create a Radware Alteon Machine
-
- Provision to an F5 BIG-IP LTM
- Provision to a Microsoft Azure Private Key Vault
- Provision to Microsoft IIS
- Provision to Microsoft Windows (PowerShell)
- Provision to Microsoft SQL Server
- Provision to a Common KeyStore
- Provision to a Citrix ADC
- Provision to an Imperva WAF
- Provision to VMware NSX Advanced Load Balancer (AVI)
- Provision to an A10 Thunder ADC
- Provision to Cloudflare
- Provision to a Kemp Virtual LoadMaster
- Provision to Palo Alto Panorama
- Provision Certificates to Radware Alteon
-
-
- 47-Day Validity Readiness TLS Certificates dashboard
- About the Certificate Inventory
- Managing Certificate Lifecycle Settings
- Reissuing Certificates in Next-Gen Trust Security
- Downloading Certificates, Certificate Chains, and Keystores
- Retiring, Recovering, and Deleting Certificates
- Finding Certificates in the Certificate Inventory
- Importing Certificates from a CA Using EJBCA
- Domain-Based Validation for External Emails
-
- Create a Workload Identity Management or Discovery Agent Built-in Account
- Create an OCI Registry Built-in Account
- Create a Certificate Manager - Self-Hosted Built-in Account
- Create a Scanafi Built-in Account
- Toggling a Built-in Account on or Off
- Editing Built-in Accounts
- Deleting Existing Built-in Accounts
- Renew Existing Built-in Accounts
- Troubleshooting
Installing VSatellites on RHEL, Oracle, and Rocky Linux
If you plan to install VSatellites on Red Hat Enterprise Linux (RHEL), Oracle Linux, or Rocky Linux, carefully review the following information.
Special Considerations
For all RHEL, Oracle, and Rocky installations, VSatellite requires two additional packages to be installed: container-selinuxand k3s-selinux.
The VSatellite installer installs k3s-selinux for you automatically. For details about k3s, refer to the k3s documentation.
However, you will need to install the container-selinux package, which is detailed below.
Install the RPM
Before installing the RPM on RHEL, see the RHEL prerequisites below.
To install the RPM, run the following:
sudo yum -y install container-selinux
RHEL Prerequisites
Before you install the RPM on RHEL, verify the following:
- You must have a valid RedHat subscription
- RHEL has the container-selinux package installed: yum list container-selinux
- Verify the list of your yum repositories: yum repolist all
- container-selinux is available on RHEL through a separate repo (which must be enabled)
- RHEL 7.x: subscription-manager repos --enable=rhel-7-server-extras-rpms
- RHEL 8.x: subscription-manager repos --enable=rhel-8-server-extras-rpms
- RHEL 9.x: subscription-manager repos --enable=rhel-9-server-extras-rpms
Note: RHEL 8.x and 9.x cloud-based RHEL VMs commonly utilize a different repository for delivering this package:
- RHEL 8.x: rhel-8-appstream-rhui-rpms
- RHEL 9.x: rhel-9-appstream-rhui-rpms
For additional information, visit Red Hat’s documentation.
Sudo secure_path Settings That Prevent Running sudo kubectl on RHEL, Oracle and Rocky Linux
By default, you will not be able to run sudo kubectl after installing VSatellite on RHEL, Oracle and Rocky Linux.
This is because vsatctl install installs k3s and kubectl in /usr/local/bin,
which is not included in the secure_path line of /etc/sudoers.
Generally, you should not need to use kubectl to interact with the VSatellite cluster,
but on rare occasions Venafi support engineers may ask you to run a kubectl command.
If you installed VSatellite on RHEL, Oracle or Rocky Linux, you can work around the secure_path problem by:
- Running sudo /usr/local/bin/kubectl.
- Running sudo -s to get a root shell and then running kubectl.
- Modifying the secure_path line in /etc/sudoers to include /usr/local/bin.